Privacy

Your account. Email address. If you sign in with Google, also the name and profile picture Google returns. If you fill in a public profile: a handle, display name, bio and any links you add. Those are published on your profile page, which is the point of them.

What you build. The messages you send, the plugins generated from them, and the ZIP files packaged for download. Plugins are private unless you publish one.

Usage. Credits consumed per generation, the model used, and token counts. This is billing arithmetic; it is not behavioural tracking.

Things you connect, if you choose to. A WordPress site address, username and application password. A GitHub access token. Both are encrypted with AES-256-GCM before being written, and neither is ever sent back to your browser. Disconnecting deletes them.

Payments. Handled entirely by Stripe. Steem stores a Stripe customer reference, your plan, and the subscription status. Card numbers never reach Steem's servers.

Steem uses Google Analytics and Microsoft Clarity to see which parts of the site work and where people get stuck. What happens before you choose depends on where you are. In the EU, EEA and UK, neither loads until you accept the banner. Everywhere else they start on and the banner says so, with a Decline that switches them off.

Either way, Decline means no script from either is fetched at all. That is a different thing from loading them and asking them not to look, and it is the version we do.

Clarity records sessions, which means it can replay how a page was used. The prompt box on the home page and the chat composer in the builder are explicitly masked, so the text of what you are asking Steem to build is never in a recording. Google Analytics gets page paths and events like “a build started” or “a ZIP was downloaded”, never the content of a prompt.

You can change your mind at any time by clearing this site's data in your browser, which resets the question.

No advertising trackers and no ad pixels. Steem does not build a profile of you, does not sell anything to anyone, and does not use your plugins to train any model.

Plugins are generated by Anthropic's Claude models. That means the text you type, any files or images you attach, and the current contents of the plugin being edited are sent to Anthropic's API to produce the result. There is no way to use the product without this happening. It is the product.

Steem also stores what you type, and whether the build worked. The prompt, the mode and effort you chose, how many credits it cost, and whether it finished, failed or ran out of budget. It is used to make the generator better at the things people actually ask for: a prompt that reliably produces a broken plugin is a bug we cannot fix if we cannot see it. It is not sold, not shared, and not used for advertising. Only prompts are kept this way, never the plugins you build.

Anthropic acts as a processor for that data and does not train on API inputs. Their handling is covered by their own privacy policy and commercial terms. If your prompt would contain something you cannot send to a third party, do not put it in the prompt.

The conversation behind each plugin is saved with the plugin, so that closing the tab does not lose it and reopening a plugin picks up where you left off. It is yours: private by default, whatever the plugin's own visibility, and never shown to anyone else unless you choose to share it.

Publishing a plugin does not publish its chat. Sharing the conversation is a separate, off-by-default choice made when you publish, and what you agree to is a snapshot: messages you send afterwards stay private until you choose again. Before it goes anywhere you are shown the exact copy that would be published, with links to your own site, email addresses and anything shaped like a key or a password already removed, and you can delete any message from it. Making a plugin private again withdraws its chat too.

That automatic removal is a safety net, not a guarantee — it recognises the shape of a credential, not the sensitivity of a sentence. Read what you are about to publish. If a message names a client or a site you would rather not connect to this plugin, take it out, or publish the plugin without the chat.

• Supabase: database, authentication and file storage, hosted in the EU (eu-west-1).
• Render: application hosting.
• Anthropic: plugin generation, as described above.
• Stripe: payments and subscription billing.
• Google: if you choose to sign in with it, and Google Analytics if you accept analytics.
• Microsoft: Clarity, if you accept analytics. Not contacted at all otherwise.
• SendGrid: delivers a message to us if you use the contact form on this page.
• GitHub: only if you connect an account, and only for the repositories you scope your token to.

Each is a service Steem uses to operate. None of them receives your data for their own marketing.

Account data and plugins are kept until you delete them or close your account. Deleting a plugin removes it and its stored ZIP. Closing your account removes your profile, plugins, connected credentials, stored tokens and your stored prompts: the prompt records are tied to your account in the database and go with it, rather than being left behind detached from a name.

Billing records are kept longer where tax and accounting law requires it, and Stripe keeps its own transaction records independently of Steem.

You can ask for a copy of what is stored about you, ask for it to be corrected, or ask for it to be deleted. Use the form below and say which. If you are in the UK or EU, the UK GDPR and GDPR give you these rights and the right to complain to your data protection authority.

If this policy changes in a way that affects what is collected or who it is shared with, the date at the top changes and account holders are emailed. Wording fixes will not be announced.